Comment by cosmojg
3 hours ago
Looking at HTTP Archive's September 2026 crawl[1], PHP shows up on 4.22M of 8.74M mobile origins, which is 48.3%.
My guess is the 70% figure comes from W3Techs[2], which currently puts PHP at 69.2%, but only of sites "whose server-side programming language we know." Given that PHP is uniquely trivial to fingerprint (via WordPress markup, .php paths, PHPSESSID cookies, etc), it is very likely that it is overrepresented in their dataset[3].
[2] https://w3techs.com/technologies/overview/programming_langua...
PHP URLs don’t have to include .php, though?
PHP apps don’t have to use the session; if an app does not start a session deliberately, there’s no cookie. Some PHP frameworks don’t use the built in session. Bespoke PHP code may simply never use it. Or perhaps they do but they rename the cookie. Laravel doesn’t use it, for example. Magento does, but it renames the cookie. Prestashop stopped using it.
Web servers don’t have to announce they use PHP at all.
It is no more uniquely trivial to fingerprint than ASP is/was, for the same reasons.
There’s really a lot of dark PHP out there; I maintain a bespoke app that you would not be able to easily establish was PHP.
One reason why the 70% figure is worth going with is that you barely need any PHP on a site to exploit php2shell anyway. It’s a runtime vulnerability. If it’s possible to provoke the server to hand a URL to a PHP runtime, it’s potentially possible to exploit. A hell of a lot of cheap hosting has ready-to-go support for PHP.